Supplier offboarding checklist

Templates are guides only. Check your contract and ask your legal team before you give notice or rely on any step below. This is not legal advice.

Ending a supplier relationship is where data gets left behind, access stays open and final invoices get paid twice. A short, consistent offboarding checklist closes those gaps. Work through it whether the contract is ending at expiry, being terminated early or moving to a new supplier.

1. Before you give notice

• Read the termination clause: notice period, how notice must be given (in writing, to which address, by what method) and any early termination fees. Our notice period calculator works out the deadline.
• Check what the contract says about exit support, handover, data return and deletion, and any exit plan already agreed.
• Check for minimum terms, committed spend or licences you will still be paying for.
• If the supplier's staff work mainly on your contract, ask HR and legal whether TUPE could apply to a transfer to a new supplier or back in-house.
• Agree who owns the exit internally, and the date by which everything must be done.
• If the service is critical, make sure the replacement (or in-house cover) is ready before the old service stops.

2. Give notice

• Send notice in the form the contract requires, before the deadline.
• Keep proof that it was sent and received.
• Confirm the end date and the exit arrangements with the supplier in writing.

3. Data

• List the data the supplier holds for you, including backups and data held by their sub-processors.
• Get your data back in a usable format before the service ends.
• Where the supplier processes personal data for you, UK GDPR Article 28 requires the contract to say that, at your choice, it deletes or returns the data at the end of the service. Ask for written confirmation of deletion.
• Update your record of processing activities and any data protection impact assessment that mentions the supplier.

4. Access and assets

• Remove the supplier's accounts from your systems, including shared and service accounts, VPN and remote access, and API keys.
• Change any passwords or keys the supplier knew.
• Collect building passes, keys, equipment and anything else you lent.
• Get back documents, designs and work in progress you own under the contract.
• Check that licences, domains or accounts registered by the supplier on your behalf are in your name.

5. Money

• Agree the final invoice and any credits, service credits or refunds due.
• Cancel standing orders, direct debits and open purchase orders.
• Close or block the supplier in your finance system once final payments are made, so no new invoices can be paid. Closed suppliers are a common route for invoice fraud.
• Check that no prepayments or retentions are left outstanding.

6. Records

• Update your contract register and supplier list with the end date and reason.
• Keep the contract, invoices and key correspondence for your retention period. Six years is a common minimum, because that's how long a claim on an ordinary contract can usually be brought, and many organisations must keep accounting records for six years too. Contracts signed as deeds can need longer.
• Record the exit decision, who made it and why.

7. Learn from it

• Write down what went well and what didn't, in a few lines.
• Note whether you would use the supplier again.
• Update your exit plans for similar suppliers.

For critical suppliers

For a T1 or T2 supplier, plan the exit long before you need it. Regulated firms are often expected to have tested exit plans for important outsourcing, and many auditors ask for them. An exit plan names the replacement options, the data to recover, how long a transition would take and who is responsible. See our page for FCA-regulated firms.

Templates are guides only. Check your contract and ask your legal team before you give notice or rely on any step below. This is not legal advice.